@rulvar/core 1.54.0 → 1.56.0

package/dist/index.js

@@ -3750,6 +3750,197 @@ function repositoryResearchToolset(options) {
 	};
 }
 //#endregion
+//#region src/tools/progress.ts
+/** The stock progress tool name the engine scans terminals for. */
+const PROGRESS_REPORT_TOOL_NAME = "report_progress";
+const PROGRESS_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["facts"],
+	properties: {
+		facts: {
+			type: "array",
+			items: { type: "string" },
+			description: "New facts established since the last report; may be empty early on."
+		},
+		evidence: {
+			type: "array",
+			items: { type: "string" },
+			description: "Evidence references backing the facts (file:line or recorded evidence ids)."
+		},
+		questions: {
+			type: "array",
+			items: { type: "string" },
+			description: "Remaining unresolved questions."
+		},
+		note: {
+			type: "string",
+			description: "Optional short status note."
+		}
+	}
+};
+/**
+* The stock progress-report tool. Stateless and deterministic: the
+* result echoes the counts, so a verbatim repeated report is a
+* duplicate result digest to the exploration guards. The value is the
+* side contract: the engine captures the LAST successful call of this
+* tool as the structured terminal partial of a 'limit' invocation, so
+* an agent that reports after every batch never loses its collected
+* work to a budget expiry.
+*/
+function progressReportTool() {
+	return tool({
+		name: PROGRESS_REPORT_TOOL_NAME,
+		description: "Report research progress after every batch of tool calls: the new facts you established, the evidence references backing them, and the questions still open. If the invocation ends at a limit, your LAST report is returned to the caller as the structured partial result, so report before the budget runs out.",
+		parameters: PROGRESS_SCHEMA,
+		risk: "read",
+		execute: (input) => {
+			const report = input;
+			return Promise.resolve({
+				recorded: true,
+				facts: report.facts?.length ?? 0,
+				evidence: report.evidence?.length ?? 0,
+				questions: report.questions?.length ?? 0
+			});
+		}
+	});
+}
+function stringArray(value) {
+	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+/**
+* The deterministic terminal scan: pairs `report_progress` tool calls
+* with their SUCCESSFUL results by id (a denied or failed call never
+* counts, mirroring the exploration guard's restore) and normalizes the
+* last one into a {@link ProgressReport}. Pure over the message window
+* it is given: the live loop hands its own history, the replay path
+* hands the terminal checkpoint's messages, and a compaction naturally
+* narrows the window to what the model itself still sees.
+*/
+function latestProgressReport(messages) {
+	const callsById = /* @__PURE__ */ new Map();
+	let latest;
+	for (const msg of messages) for (const part of msg.parts) if (part.type === "tool-call" && part.name === "report_progress") callsById.set(part.id, part.args);
+	else if (part.type === "tool-result" && part.name === "report_progress" && part.isError !== true && callsById.has(part.id)) {
+		const args = callsById.get(part.id);
+		if (typeof args === "object" && args !== null && !Array.isArray(args)) {
+			const record = args;
+			const report = {
+				facts: stringArray(record.facts),
+				evidence: stringArray(record.evidence),
+				questions: stringArray(record.questions)
+			};
+			if (typeof record.note === "string") report.note = record.note;
+			latest = report;
+		}
+	}
+	return latest;
+}
+//#endregion
+//#region src/engine/profile-templates.ts
+/**
+* The research template's stop conditions: a weighted unit budget over
+* the research tools (bookkeeping tools are free), per-tool caps, both
+* repetition guards, and soft budget notices. Exported so hosts and
+* tests can read the exact defaults they are overriding.
+*/
+const RESEARCH_PROFILE_LIMITS = {
+	maxTurns: 24,
+	maxToolCalls: 48,
+	toolBudgetNotices: true,
+	maxRepeatedToolSignature: 2,
+	maxNoNewEvidenceCalls: 6,
+	maxCallsPerTool: {
+		list_files: 12,
+		search_files: 20,
+		read_file: 30
+	},
+	toolUnits: {
+		max: 64,
+		costs: {
+			list_files: 1,
+			search_files: 2,
+			read_file: 2,
+			record_evidence: 0,
+			list_evidence: 0,
+			report_progress: 0
+		}
+	}
+};
+/** The implementation template's stop conditions. */
+const IMPLEMENTATION_PROFILE_LIMITS = {
+	maxTurns: 32,
+	maxToolCalls: 64,
+	toolBudgetNotices: true,
+	maxRepeatedToolSignature: 3,
+	noProgressTurns: 3
+};
+/** The review template's stop conditions. */
+const REVIEW_PROFILE_LIMITS = {
+	maxTurns: 16,
+	maxToolCalls: 32,
+	toolBudgetNotices: true,
+	maxRepeatedToolSignature: 2,
+	maxNoNewEvidenceCalls: 8
+};
+function mergeLimits(template, overrides) {
+	return {
+		...template,
+		...overrides ?? {}
+	};
+}
+/**
+* The batteries-included research child: the confined
+* {@link repositoryResearchToolset} over `root`, the stock
+* report_progress tool, and {@link RESEARCH_PROFILE_LIMITS} as the stop
+* conditions. A child spawned from this profile that runs out of budget
+* settles 'limit' WITH its last progress report as the structured
+* partial, and the recorded evidence stays readable host-side through
+* `evidence()`.
+*/
+function researchAgentProfile(options) {
+	const { description, limits, extraTools, ...toolsetOptions } = options;
+	const kit = repositoryResearchToolset(toolsetOptions);
+	return {
+		profile: {
+			description: description ?? "Repository research over a confined root: paginated list_files/search_files/read_file with stable cursors, record_evidence verifying every citation, and report_progress after every batch. Stop conditions built in: weighted tool units, per-tool caps, repetition and no-new-evidence guards, budget notices. On limit the last progress report is the structured partial.",
+			tools: [
+				...kit.tools,
+				progressReportTool(),
+				...extraTools ?? []
+			],
+			limits: mergeLimits(RESEARCH_PROFILE_LIMITS, limits)
+		},
+		evidence: () => kit.evidence()
+	};
+}
+/**
+* The implementation child template: the caller's task tools plus the
+* progress contract, with {@link IMPLEMENTATION_PROFILE_LIMITS} as the
+* stop conditions (a no-progress detector instead of the research
+* no-new-evidence guard: implementation legitimately re-reads state).
+*/
+function implementationAgentProfile(options = {}) {
+	return {
+		description: options.description ?? "Implementation work with built-in stop conditions: tool budget with notices, repeated-call guard, no-progress detector. Report progress with report_progress after every batch; on limit the last report is the structured partial.",
+		tools: [progressReportTool(), ...options.tools ?? []],
+		limits: mergeLimits(IMPLEMENTATION_PROFILE_LIMITS, options.limits)
+	};
+}
+/**
+* The review child template: the caller's task tools plus the progress
+* contract, with {@link REVIEW_PROFILE_LIMITS} as the stop conditions
+* (a tighter turn budget and the no-new-evidence guard: a reviewer
+* circling over the same pages should stop, not spin).
+*/
+function reviewAgentProfile(options = {}) {
+	return {
+		description: options.description ?? "Focused review with built-in stop conditions: tight turn and tool budgets with notices, repetition and no-new-evidence guards. Report findings with report_progress after every batch; on limit the last report is the structured partial.",
+		tools: [progressReportTool(), ...options.tools ?? []],
+		limits: mergeLimits(REVIEW_PROFILE_LIMITS, options.limits)
+	};
+}
+//#endregion
 //#region src/journal/identity.ts
 /**
 * Content-addressed entry identity (M1-T04): IdentityInput records per
@@ -7733,9 +7924,10 @@ var Semaphore = class {
 * ride RetryPolicy; hosts with known tier limits opt in per adapter id
 * via createEngine concurrency.perProvider.
 *
-* There is deliberately NO distributed cross-process limiter: two
-* processes sharing one API key coordinate nothing here (a
-* process-global limiter is an open question).
+* This keyed limiter bounds PARALLELISM inside one engine only. Two
+* processes sharing one API key coordinate through the QuotaLimiter
+* SPI instead (RV-215, createEngine `quota`): rate and volume live
+* there, in shared storage; in-flight slots live here.
 */
 var KeyedLimiter = class {
 	semaphores = /* @__PURE__ */ new Map();
@@ -7936,6 +8128,223 @@ function liftRetainedParts(providerMetadata, adapter) {
 	}));
 }
 //#endregion
+//#region src/model/quota.ts
+/**
+* Quota rules and the in-process reference QuotaLimiter (RV-215).
+* The rule model is shared by every reference implementation
+* (memoryQuotaLimiter here, SqliteQuotaLimiter in
+* @rulvar/store-sqlite): fixed one-minute windows aligned to the
+* epoch, admission at reservation time, reconciliation to actual
+* usage inside the same window. The hard guarantee is on
+* `requestsPerMinute` (every wire attempt is exactly one request);
+* `tokensPerMinute` admits on the heuristic estimate and settles to
+* actual usage, so token windows are approximate at admission and
+* exact at settlement.
+*
+* Docs: https://docs.rulvar.com/guide/model-routing
+*/
+/**
+* Captured at module load, before the InProcessRunner's
+* nondeterminism guard can patch the global: the limiter's clock is
+* engine infrastructure on the live-only dispatch path and must never
+* be blamed on workflow code.
+*/
+const nativeNow = Date.now;
+/** The fixed accounting window every PerMinute cap counts over. */
+const QUOTA_WINDOW_MS = 6e4;
+/**
+* Validates a quota rule set as a typed ConfigError before any
+* limiter can admit under it: a non-array or empty set, a rule
+* without a cap, a malformed dimension, or a malformed cap all fail
+* loud at construction. Shared by every reference implementation.
+*/
+function validateQuotaRules(rules, site = "quota rules") {
+	const raw = rules;
+	if (!Array.isArray(raw)) throw new ConfigError(`${site} must be an array of QuotaRule objects`);
+	if (raw.length === 0) throw new ConfigError(`${site} must contain at least one rule`);
+	raw.forEach((entry, index) => {
+		const at = `${site}[${String(index)}]`;
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new ConfigError(`${at} must be a QuotaRule object`);
+		const rule = entry;
+		for (const dimension of [
+			"provider",
+			"model",
+			"tenant"
+		]) {
+			const value = rule[dimension];
+			if (value !== void 0 && (typeof value !== "string" || value === "")) throw new ConfigError(`${at}.${dimension} must be a nonempty string when given`);
+		}
+		if (rule.requestsPerMinute === void 0 && rule.tokensPerMinute === void 0) throw new ConfigError(`${at} must set requestsPerMinute or tokensPerMinute (or both)`);
+		for (const cap of ["requestsPerMinute", "tokensPerMinute"]) if (rule[cap] !== void 0) requirePositiveInteger(rule[cap], `${at}.${cap}`);
+	});
+}
+/** True when every dimension the rule pins matches the request. */
+function quotaRuleMatches(rule, request) {
+	return (rule.provider === void 0 || rule.provider === request.provider) && (rule.model === void 0 || rule.model === request.model) && (rule.tenant === void 0 || rule.tenant === request.tenant);
+}
+/** The tokens a reservation is admitted under: input estimate plus the output cap. */
+function quotaEstimateTokens(request) {
+	return request.estimate.inputTokens + (request.estimate.maxOutputTokens ?? 0);
+}
+/** The tokens a settled attempt actually consumed. */
+function quotaActualTokens(usage) {
+	return usage.inputTokens + usage.outputTokens;
+}
+/**
+* One rule's admission verdict against its current-window counters,
+* the pure decision both reference implementations share. A denial
+* carries the window remainder as retryAfterMs, except when the
+* estimate alone can never fit the token cap: that denial says
+* retryAfterMs 0 (retry immediately), so the caller's bounded
+* attempts exhaust without waiting and failover gets its chance.
+*/
+function quotaRuleAdmission(rule, counters, estimate, msUntilWindowEnd) {
+	if (rule.requestsPerMinute !== void 0 && counters.requests + estimate.requests > rule.requestsPerMinute) return {
+		admit: false,
+		retryAfterMs: msUntilWindowEnd,
+		reason: `requestsPerMinute ${String(rule.requestsPerMinute)} exhausted`
+	};
+	if (rule.tokensPerMinute !== void 0) {
+		if (estimate.tokens > rule.tokensPerMinute) return {
+			admit: false,
+			retryAfterMs: 0,
+			reason: `the estimate of ${String(estimate.tokens)} tokens can never fit tokensPerMinute ${String(rule.tokensPerMinute)}`
+		};
+		if (counters.tokens + estimate.tokens > rule.tokensPerMinute) return {
+			admit: false,
+			retryAfterMs: msUntilWindowEnd,
+			reason: `tokensPerMinute ${String(rule.tokensPerMinute)} exhausted`
+		};
+	}
+	return { admit: true };
+}
+/**
+* Folds one more failing rule into the decision the caller returns:
+* the wait is the LONGEST failing horizon (every matching rule must
+* admit), and the FIRST failing rule names the denial.
+*/
+function mergeQuotaDenial(current, next) {
+	if (current === void 0) return {
+		retryAfterMs: next.retryAfterMs,
+		reason: next.reason
+	};
+	return next.retryAfterMs > current.retryAfterMs ? {
+		retryAfterMs: next.retryAfterMs,
+		reason: current.reason
+	} : current;
+}
+/**
+* The in-process reference QuotaLimiter: fixed epoch-aligned
+* one-minute windows over the shared rule model. Coordinates every
+* engine that shares THIS instance inside one process; processes
+* coordinate through a shared-storage implementation of the same SPI
+* (SqliteQuotaLimiter in @rulvar/store-sqlite) instead.
+*/
+function memoryQuotaLimiter(rules, options = {}) {
+	validateQuotaRules(rules, "memoryQuotaLimiter rules");
+	const now = options.now ?? (() => nativeNow());
+	const buckets = /* @__PURE__ */ new Map();
+	const reservations = /* @__PURE__ */ new Map();
+	let nextReservation = 0;
+	const windowStartAt = (at) => at - at % QUOTA_WINDOW_MS;
+	const bucketFor = (ruleIndex, windowStart) => {
+		let bucket = buckets.get(ruleIndex);
+		if (bucket === void 0 || bucket.windowStart !== windowStart) {
+			bucket = {
+				windowStart,
+				requests: 0,
+				tokens: 0
+			};
+			buckets.set(ruleIndex, bucket);
+		}
+		return bucket;
+	};
+	const prune = (windowStart) => {
+		for (const [id, reservation] of reservations) if (reservation.windowStart < windowStart) reservations.delete(id);
+	};
+	return {
+		reserve(request) {
+			const at = now();
+			const windowStart = windowStartAt(at);
+			prune(windowStart);
+			const estimateTokens = quotaEstimateTokens(request);
+			const msUntilWindowEnd = windowStart + QUOTA_WINDOW_MS - at;
+			const matched = [];
+			let denial;
+			rules.forEach((rule, index) => {
+				if (!quotaRuleMatches(rule, request)) return;
+				matched.push(index);
+				const verdict = quotaRuleAdmission(rule, bucketFor(index, windowStart), {
+					requests: request.estimate.requests,
+					tokens: estimateTokens
+				}, msUntilWindowEnd);
+				if (!verdict.admit) denial = mergeQuotaDenial(denial, verdict);
+			});
+			if (denial !== void 0) return Promise.resolve({
+				granted: false,
+				...denial
+			});
+			for (const index of matched) {
+				const bucket = bucketFor(index, windowStart);
+				bucket.requests += request.estimate.requests;
+				bucket.tokens += estimateTokens;
+			}
+			nextReservation += 1;
+			const reservationId = `mq-${String(nextReservation)}`;
+			reservations.set(reservationId, {
+				windowStart,
+				estimateTokens,
+				ruleIndexes: matched
+			});
+			return Promise.resolve({
+				granted: true,
+				reservationId
+			});
+		},
+		reconcile(reservationId, usage) {
+			const reservation = reservations.get(reservationId);
+			if (reservation === void 0) return Promise.resolve();
+			reservations.delete(reservationId);
+			const windowStart = windowStartAt(now());
+			if (reservation.windowStart !== windowStart) return Promise.resolve();
+			const delta = quotaActualTokens(usage) - reservation.estimateTokens;
+			for (const index of reservation.ruleIndexes) {
+				const bucket = buckets.get(index);
+				if (bucket !== void 0 && bucket.windowStart === windowStart) bucket.tokens = Math.max(0, bucket.tokens + delta);
+			}
+			return Promise.resolve();
+		},
+		snapshot() {
+			const windowStart = windowStartAt(now());
+			return rules.map((rule, index) => {
+				const bucket = buckets.get(index);
+				const current = bucket !== void 0 && bucket.windowStart === windowStart;
+				return {
+					rule,
+					windowStart,
+					requests: current ? bucket.requests : 0,
+					tokens: current ? bucket.tokens : 0
+				};
+			});
+		}
+	};
+}
+/**
+* Validates createEngine's quota config as a typed ConfigError before
+* any run could dispatch under a malformed limiter (the intake
+* discipline every engine option follows).
+*/
+function validateEngineQuotaConfig(config, site = "createEngine quota") {
+	if (config === void 0) return;
+	const raw = config;
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new ConfigError(`${site} must be an object with a limiter`);
+	const candidate = raw;
+	const limiter = candidate.limiter;
+	if (typeof limiter !== "object" || limiter === null || typeof limiter.reserve !== "function" || typeof limiter.reconcile !== "function") throw new ConfigError(`${site}.limiter must implement QuotaLimiter (reserve and reconcile functions)`);
+	if (candidate.tenant !== void 0 && (typeof candidate.tenant !== "string" || candidate.tenant === "")) throw new ConfigError(`${site}.tenant must be a nonempty string when given`);
+	if (candidate.onLimiterError !== void 0 && candidate.onLimiterError !== "deny" && candidate.onLimiterError !== "allow") throw new ConfigError(`${site}.onLimiterError must be 'deny' or 'allow' when given`);
+}
+//#endregion
 //#region src/model/retry.ts
 /**
 * Transport RetryPolicy (M4-T05): retries live UNDER the journal. A
@@ -8461,6 +8870,10 @@ function mergeUsageLimits(call, profile, engine) {
 	if (maxRepeatedToolSignature !== void 0) merged.maxRepeatedToolSignature = maxRepeatedToolSignature;
 	const maxNoNewEvidenceCalls = pick("maxNoNewEvidenceCalls");
 	if (maxNoNewEvidenceCalls !== void 0) merged.maxNoNewEvidenceCalls = maxNoNewEvidenceCalls;
+	const maxCallsPerTool = pick("maxCallsPerTool");
+	if (maxCallsPerTool !== void 0) merged.maxCallsPerTool = maxCallsPerTool;
+	const toolUnits = pick("toolUnits");
+	if (toolUnits !== void 0) merged.toolUnits = toolUnits;
 	return merged;
 }
 /**
@@ -8485,6 +8898,21 @@ function validateUsageLimits(limits, site) {
 	if (limits.toolBudgetNotices !== void 0 && typeof limits.toolBudgetNotices !== "boolean") throw new ConfigError(`${site}.toolBudgetNotices must be a boolean; got ${typeof limits.toolBudgetNotices}`);
 	if (limits.maxRepeatedToolSignature !== void 0) requirePositiveInteger(limits.maxRepeatedToolSignature, `${site}.maxRepeatedToolSignature`);
 	if (limits.maxNoNewEvidenceCalls !== void 0) requirePositiveInteger(limits.maxNoNewEvidenceCalls, `${site}.maxNoNewEvidenceCalls`);
+	if (limits.maxCallsPerTool !== void 0) {
+		const caps = limits.maxCallsPerTool;
+		if (typeof caps !== "object" || caps === null || Array.isArray(caps)) throw new ConfigError(`${site}.maxCallsPerTool must be a record of per-tool caps`);
+		for (const [name, cap] of Object.entries(caps)) requireNonNegativeInteger(cap, `${site}.maxCallsPerTool['${name}']`);
+	}
+	if (limits.toolUnits !== void 0) {
+		const units = limits.toolUnits;
+		if (typeof units !== "object" || units === null || Array.isArray(units)) throw new ConfigError(`${site}.toolUnits must be { max, costs? }`);
+		const { max, costs } = units;
+		requirePositiveInteger(max, `${site}.toolUnits.max`);
+		if (costs !== void 0) {
+			if (typeof costs !== "object" || costs === null || Array.isArray(costs)) throw new ConfigError(`${site}.toolUnits.costs must be a record of per-tool costs`);
+			for (const [name, cost] of Object.entries(costs)) requireNonNegativeInteger(cost, `${site}.toolUnits.costs['${name}']`);
+		}
+	}
 }
 //#endregion
 //#region src/runtime/model-retry.ts
@@ -9019,7 +9447,7 @@ function formatRePrompt(issues, attempt, maxAttempts) {
 const GUARD_DOCS_URL = "https://docs.rulvar.com/guide/agents#exploration-guards";
 /** True when any exploration guard field asks for tracking. */
 function explorationTrackingEnabled(limits) {
-	return limits.maxRepeatedToolSignature !== void 0 || limits.maxNoNewEvidenceCalls !== void 0 || limits.toolBudgetNotices === true;
+	return limits.maxRepeatedToolSignature !== void 0 || limits.maxNoNewEvidenceCalls !== void 0 || limits.toolBudgetNotices === true || limits.maxCallsPerTool !== void 0 || limits.toolUnits !== void 0;
 }
 function digestOf$1(value) {
 	try {
@@ -9038,6 +9466,8 @@ var ExplorationGuard = class {
 	repeated = 0;
 	duplicateResults = 0;
 	denied = 0;
+	deniedToolCap = 0;
+	unitsUsed = 0;
 	unserializableSeq = 0;
 	constructor(config) {
 		this.config = config;
@@ -9075,10 +9505,25 @@ var ExplorationGuard = class {
 		}
 	}
 	/**
-	* The pre-dispatch verdict: denies the call that would exceed
-	* maxRepeatedToolSignature executions of the same signature.
+	* The pre-dispatch verdict: denies the call that would exceed its
+	* tool's maxCallsPerTool cap, then the call that would exceed
+	* maxRepeatedToolSignature executions of the same signature. A denial
+	* never consumes maxToolCalls or tool units.
 	*/
 	beforeExecute(name, args) {
+		const cap = this.config.maxCallsPerTool?.[name];
+		if (cap !== void 0) {
+			const executions = this.byTool.get(name) ?? 0;
+			if (executions >= cap) {
+				this.deniedToolCap += 1;
+				return {
+					deny: true,
+					guard: "per-tool-cap",
+					executions,
+					reason: `exploration guard: '${name}' already executed ${String(executions)} time(s) this invocation (maxCallsPerTool ${String(cap)}). Use what you have or a different tool (${GUARD_DOCS_URL}).`
+				};
+			}
+		}
 		const max = this.config.maxRepeatedToolSignature;
 		if (max === void 0) return { deny: false };
 		const executions = this.signatureExecutions.get(this.signatureOf(name, args)) ?? 0;
@@ -9086,6 +9531,7 @@ var ExplorationGuard = class {
 		this.denied += 1;
 		return {
 			deny: true,
+			guard: "repeated-signature",
 			executions,
 			reason: `exploration guard: this exact '${name}' call already executed ${String(executions)} time(s) this invocation (maxRepeatedToolSignature ${String(max)}). Reuse the earlier result or change the arguments (${GUARD_DOCS_URL}).`
 		};
@@ -9103,6 +9549,7 @@ var ExplorationGuard = class {
 	recordExecution(name, args, result, successful) {
 		this.executed += 1;
 		this.byTool.set(name, (this.byTool.get(name) ?? 0) + 1);
+		if (this.config.toolUnits !== void 0) this.unitsUsed += this.config.toolUnits.costs?.[name] ?? 1;
 		const signature = this.signatureOf(name, args);
 		const prior = this.signatureExecutions.get(signature) ?? 0;
 		if (prior > 0) this.repeated += 1;
@@ -9119,6 +9566,14 @@ var ExplorationGuard = class {
 		const max = this.config.maxNoNewEvidenceCalls;
 		return max !== void 0 && this.noNewEvidenceStreak >= max;
 	}
+	/**
+	* True once the spent tool units reached the weighted budget: the
+	* loop's pre-dispatch check, mirroring maxToolCalls (terminal 'limit',
+	* paid partial work). Never true without toolUnits configured.
+	*/
+	unitsExhausted() {
+		return this.config.toolUnits !== void 0 && this.unitsUsed >= this.config.toolUnits.max;
+	}
 	/** The abort message for a tripped no-new-evidence guard. */
 	describeTrip() {
 		return `exploration guard: ${String(this.noNewEvidenceStreak)} consecutive tool calls returned no new evidence (maxNoNewEvidenceCalls ${String(this.config.maxNoNewEvidenceCalls ?? this.noNewEvidenceStreak)}; every result was already seen this invocation). The executed work is kept; narrow the scope, vary the queries, or raise the limit (${GUARD_DOCS_URL}).`;
@@ -9133,7 +9588,9 @@ var ExplorationGuard = class {
 			repeatedCalls: this.repeated,
 			duplicateResultCalls: this.duplicateResults,
 			deniedRepeats: this.denied,
-			byTool
+			byTool,
+			...this.config.maxCallsPerTool === void 0 ? {} : { deniedToolCap: this.deniedToolCap },
+			...this.config.toolUnits === void 0 ? {} : { toolUnitsUsed: this.unitsUsed }
 		};
 	}
 };
@@ -9743,6 +10200,10 @@ async function runAgent(options) {
 				parts,
 				limitHit: true
 			};
+			if (guard !== void 0 && guard.unitsExhausted()) return {
+				parts,
+				limitHit: true
+			};
 			const def = runtime.defs.find((candidate) => candidate.name === call.name);
 			events?.emit({
 				type: "tool:start",
@@ -9898,11 +10359,11 @@ async function runAgent(options) {
 						toolName: gatedCall.name,
 						outcome: "denied",
 						durationMs: now() - gateStartedAt,
-						guard: "repeated-signature"
+						guard: guardVerdict.guard
 					});
 					parts.push(errorPart(call, {
 						error: guardVerdict.reason,
-						guard: "repeated-signature"
+						guard: guardVerdict.guard
 					}));
 					continue;
 				}
@@ -10068,12 +10529,74 @@ async function runAgent(options) {
 			const target = site.chain[site.cursor.index] ?? site.chain[0];
 			let tries = 0;
 			inner: for (;;) {
+				let reservationId;
+				const quotaDeniedOutcome = (denial) => ({
+					turn: {
+						text: "",
+						toolCalls: []
+					},
+					usage: ZERO_USAGE$1,
+					reported: ZERO_USAGE$1,
+					usageApprox: false,
+					quotaDenied: true,
+					wireError: {
+						code: denial.infrastructure === void 0 ? "rate-limit" : "quota-limiter",
+						message: denial.infrastructure ?? `the shared quota limiter denied ${target.resolved.ref}` + (denial.reason === void 0 ? "" : `: ${denial.reason}`),
+						retryable: true,
+						data: {
+							kind: denial.infrastructure === void 0 ? "rate-limit" : "transport",
+							source: "quota-limiter",
+							...denial.retryAfterMs === void 0 ? {} : { retryAfterMs: denial.retryAfterMs },
+							...denial.reason === void 0 ? {} : { reason: denial.reason }
+						}
+					}
+				});
+				const dispatchWithQuota = async (quota) => {
+					const req = site.requestFor(target);
+					let decision;
+					try {
+						decision = await quota.reserve({
+							provider: target.adapter.id,
+							model: target.resolved.model,
+							estimate: {
+								requests: 1,
+								inputTokens: estimateInputTokens(req.messages),
+								...req.maxOutputTokens === void 0 ? {} : { maxOutputTokens: req.maxOutputTokens }
+							}
+						});
+					} catch (thrown) {
+						const detail = thrown instanceof Error ? thrown.message : String(thrown);
+						if (quota.onLimiterError === "allow") {
+							events?.emit({
+								type: "log",
+								level: "warn",
+								msg: `the shared quota limiter failed; dispatching ${target.resolved.ref} without a reservation (onLimiterError 'allow'): ${detail}`
+							});
+							return streamTurn(target.adapter, req, site.streamOptionsFor(target));
+						}
+						return quotaDeniedOutcome({ infrastructure: `the shared quota limiter failed (onLimiterError 'deny'): ${detail}` });
+					}
+					if (!decision.granted) return quotaDeniedOutcome(decision);
+					reservationId = decision.reservationId;
+					return streamTurn(target.adapter, req, site.streamOptionsFor(target));
+				};
 				const dispatch = () => {
 					const aborted = abortKind();
-					return aborted === void 0 ? streamTurn(target.adapter, site.requestFor(target), site.streamOptionsFor(target)) : Promise.resolve(abortedOutcome(aborted));
+					if (aborted !== void 0) return Promise.resolve(abortedOutcome(aborted));
+					return options.quota === void 0 ? streamTurn(target.adapter, site.requestFor(target), site.streamOptionsFor(target)) : dispatchWithQuota(options.quota);
 				};
 				const outcome = await (options.providerSlot === void 0 ? dispatch() : options.providerSlot(target.adapter.id, dispatch, options.signal));
-				recordUsage(outcome.usage, outcome.reported, target.adapter.id, target.resolved.ref, site.role, outcome.usageViolation);
+				if (reservationId !== void 0 && options.quota !== void 0) try {
+					await options.quota.reconcile(reservationId, outcome.usage);
+				} catch (thrown) {
+					const detail = thrown instanceof Error ? thrown.message : String(thrown);
+					events?.emit({
+						type: "log",
+						level: "warn",
+						msg: `the shared quota limiter failed to reconcile a reservation: ${detail}`
+					});
+				}
+				if (outcome.quotaDenied !== true) recordUsage(outcome.usage, outcome.reported, target.adapter.id, target.resolved.ref, site.role, outcome.usageViolation);
 				tries += 1;
 				const retryClass = outcome.aborted === "idle" ? "transport" : outcome.wireError === void 0 ? void 0 : retryClassOf(outcome.wireError);
 				if (retryClass === void 0) return {
@@ -10751,6 +11274,8 @@ async function runAgent(options) {
 		}
 		endPhase(extractPhase, phaseOutcome(), extractServed);
 	}
+	const limitPartial = status === "limit" ? latestProgressReport(messages) : void 0;
+	if (limitPartial !== void 0) await saveBoundary();
 	let transcriptRef = "";
 	if (options.transcript !== void 0) {
 		transcriptRef = options.transcript.mintRef();
@@ -10773,6 +11298,7 @@ async function runAgent(options) {
 	if (abortClass !== void 0) result.abortClass = abortClass;
 	if (errorMessage !== void 0) result.errorMessage = errorMessage;
 	if (guard !== void 0) result.exploration = guard.summary(toolCallsUsed);
+	if (limitPartial !== void 0) result.partial = limitPartial;
 	if (usageApprox) result.usageApprox = true;
 	if (transportRetries > 0) result.transportRetries = transportRetries;
 	return result;
@@ -11744,7 +12270,13 @@ const WAKE_SUMMARY_RENDER_BUDGET_CHARS = 400;
 * spawn ordinal; the LLM distillation upgrade is M7 territory).
 */
 function summarizeOutput(result) {
-	return truncateToBudget(result.status === "ok" ? typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null) : result.errorMessage ?? `terminal status ${result.status}`, 400);
+	let raw;
+	if (result.status === "ok") raw = typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
+	else {
+		raw = result.errorMessage ?? `terminal status ${result.status}`;
+		if (result.partial !== void 0) raw = `${raw}; partial: ${JSON.stringify(result.partial)}`;
+	}
+	return truncateToBudget(raw, 400);
 }
 /** Folds one settled child into its digest (spawn-ordinal ordering is the caller's). */
 function digestOf(record, result) {
@@ -12617,6 +13149,10 @@ function createCtx(internals, rootWorkflow) {
 				const checkpoint = blob === null ? void 0 : decodeCheckpoint(blob);
 				if (checkpoint !== void 0) {
 					result.turns = checkpoint.turns;
+					if (result.status === "limit") {
+						const partialReport = latestProgressReport(checkpoint.messages);
+						if (partialReport !== void 0) result.partial = partialReport;
+					}
 					replayedToolResults = checkpoint.messages.filter((msg) => msg.role === "tool").flatMap((msg) => msg.parts).filter((part) => part.type === "tool-result").map((part) => ({
 						name: part.name,
 						isError: part.isError === true
@@ -12995,6 +13531,18 @@ function createCtx(internals, rootWorkflow) {
 		if (profile?.compaction !== void 0) runAgentOptions.compaction = profile.compaction;
 		if (loopFallbacks.length > 0) runAgentOptions.fallbacks = loopFallbacks;
 		if (retryPolicy !== void 0) runAgentOptions.retry = { policy: retryPolicy };
+		if (internals.quota !== void 0) {
+			const quota = internals.quota;
+			runAgentOptions.quota = {
+				reserve: (request) => quota.limiter.reserve({
+					...request,
+					runId: internals.runId,
+					...quota.tenant === void 0 ? {} : { tenant: quota.tenant }
+				}),
+				reconcile: (reservationId, usage) => quota.limiter.reconcile(reservationId, usage),
+				onLimiterError: quota.onLimiterError
+			};
+		}
 		if (internals.providerLimiter !== void 0) {
 			const limiter = internals.providerLimiter;
 			runAgentOptions.providerSlot = (key, fn, signal) => limiter.withSlot(key, fn, () => internals.events.emit({
@@ -13817,7 +14365,14 @@ function pageOf(content, rawOffset, rawMaxChars) {
 }
 /** The serialized full result of a settled child: the raw string, or JSON. */
 function serializeChildOutput(result) {
-	if (result.status !== "ok") return result.errorMessage ?? `terminal status ${result.status}`;
+	if (result.status !== "ok") {
+		const base = result.errorMessage ?? `terminal status ${result.status}`;
+		if (result.partial !== void 0) return JSON.stringify({
+			error: base,
+			partial: result.partial
+		});
+		return base;
+	}
 	return typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
 }
 /**
@@ -13839,6 +14394,8 @@ function validateOrchestrateOptions(opts) {
 		const minSuccessful = typeof policy === "object" && policy !== null && !Array.isArray(policy) ? policy.minSuccessful : void 0;
 		if (policy !== "all-ok" && minSuccessful === void 0) throw new ConfigError(`orchestrate acceptance.childPolicy must be 'all-ok' or { minSuccessful: N }; got ${JSON.stringify(policy)}`);
 		if (policy !== "all-ok") requirePositiveInteger(minSuccessful, "orchestrate acceptance.childPolicy.minSuccessful");
+		const acceptPartial = opts.acceptance.acceptPartialChildren;
+		if (acceptPartial !== void 0 && typeof acceptPartial !== "boolean") throw new ConfigError(`orchestrate acceptance.acceptPartialChildren must be a boolean; got ${typeof acceptPartial}`);
 	}
 	if (opts.finishValidation !== void 0) {
 		const fv = opts.finishValidation;
@@ -13903,6 +14460,16 @@ function finishValidationPromptLines(spec) {
 	return [`The host validates every finish({ result }) with deterministic validators: ${names}.`, "A rejected finish returns the failure reasons as the tool error result; repair the result and call finish again. " + (repairs === 0 ? "No repair attempt is granted: the first rejected finish fails the run." : repairs === 1 ? "At most one repair attempt is granted before the run fails." : `At most ${String(repairs)} repair attempts are granted before the run fails.`)];
 }
 /**
+* The partial-salvage contract rides the PROMPT exactly like finish
+* validation (RV-210 close-out): present only when
+* acceptance.acceptPartialChildren is set, so every other configuration
+* keeps byte-identical coordination prompts.
+*/
+function acceptancePromptLines(acceptance) {
+	if (acceptance?.acceptPartialChildren !== true) return [];
+	return ["Partial salvage is on: a child that ends at its limit AFTER recording progress with report_progress counts as a partial success for acceptance; its digest carries the partial and get_child_result (when enabled) pages the full report. When the gap matters, respawn a NARROWED child carrying the partial instead of repeating the task."];
+}
+/**
 * Resolves per-spawn dispatch options against the engine registries
 * (registered SchemaSpec and tool profile names; M7-T05). An
 * unknown ref is a typed ConfigError, surfaced as a tool error to the
@@ -15232,7 +15799,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const priorRejection = validationDecisions().find((decision) => decision.verdict === "rejected");
 			if (priorRejection !== void 0) throw finishValidationError(priorRejection);
 		}
-		const promptLines = [...extension?.promptLines?.() ?? [], ...finishValidationPromptLines(validationSpec)];
+		const promptLines = [
+			...extension?.promptLines?.() ?? [],
+			...finishValidationPromptLines(validationSpec),
+			...acceptancePromptLines(opts?.acceptance)
+		];
 		const result = await runtime.runInScope(orchestratorState, () => ctx.agent(orchestratorPrompt(goal, opts?.maxSpawns, promptLines.length === 0 ? void 0 : promptLines), agentOpts));
 		const liveTermination = extensionTermination;
 		if (liveTermination !== void 0) throw liveTermination;
@@ -15248,21 +15819,32 @@ function makeOrchestratorWorkflow(goal, opts) {
 		else {
 			const childStatusCounts = {};
 			const degradedReasons = [];
+			const salvaged = [];
+			let hardDegraded = 0;
+			const acceptPartial = opts.acceptance.acceptPartialChildren === true;
 			const sortedRecords = [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
 			for (const record of sortedRecords) {
 				const status = record.settled?.status ?? "running";
 				childStatusCounts[status] = (childStatusCounts[status] ?? 0) + 1;
-				if (status !== "ok") degradedReasons.push(status === "running" ? `child ${record.nodeId} was still running when finish validated` : `child ${record.nodeId} settled '${status}'`);
+				if (status === "ok") continue;
+				if (acceptPartial && status === "limit" && record.settled?.partial !== void 0) {
+					salvaged.push(record.nodeId);
+					degradedReasons.push(`child ${record.nodeId} accepted as partial (settled 'limit' with a structured partial)`);
+					continue;
+				}
+				hardDegraded += 1;
+				degradedReasons.push(status === "running" ? `child ${record.nodeId} was still running when finish validated` : `child ${record.nodeId} settled '${status}'`);
 			}
 			const childPolicy = opts.acceptance.childPolicy;
-			const accepted = childPolicy === "all-ok" ? degradedReasons.length === 0 : (childStatusCounts.ok ?? 0) >= childPolicy.minSuccessful;
+			const accepted = childPolicy === "all-ok" ? hardDegraded === 0 : (childStatusCounts.ok ?? 0) + salvaged.length >= childPolicy.minSuccessful;
 			decision = {
 				decisionType: "orchestrator_acceptance",
 				verdict: accepted ? "accepted" : "rejected",
 				completion: !accepted ? "rejected" : degradedReasons.length === 0 ? "complete" : "partial",
 				childPolicy,
 				childStatusCounts,
-				degradedReasons
+				degradedReasons,
+				...salvaged.length === 0 ? {} : { salvagedPartialChildren: salvaged }
 			};
 			await internals.replayer.appendSinglePhase({
 				scope: callingState.scope,
@@ -15281,14 +15863,16 @@ function makeOrchestratorWorkflow(goal, opts) {
 				completion: "rejected",
 				childPolicy: decision.childPolicy,
 				childStatusCounts: decision.childStatusCounts,
-				degradedReasons: decision.degradedReasons
+				degradedReasons: decision.degradedReasons,
+				...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren }
 			} });
 		}
 		return {
 			result: await runSynthesis(result.output),
 			completion: decision.completion,
 			childStatusCounts: decision.childStatusCounts,
-			degradedReasons: decision.degradedReasons
+			degradedReasons: decision.degradedReasons,
+			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren }
 		};
 	});
 }
@@ -16030,6 +16614,12 @@ function createEngine(options) {
 		if (profile.compaction?.threshold !== void 0) requireFraction(profile.compaction.threshold, `createEngine defaults.profiles['${name}'].compaction.threshold`);
 	}
 	validateDeterminismConfig(options.determinism);
+	validateEngineQuotaConfig(options.quota);
+	const quotaRuntime = options.quota === void 0 ? void 0 : {
+		limiter: options.quota.limiter,
+		...options.quota.tenant === void 0 ? {} : { tenant: options.quota.tenant },
+		onLimiterError: options.quota.onLimiterError ?? "deny"
+	};
 	const knowledgeStore = options.stores?.modelKnowledge;
 	const knowledge = knowledgeStore === void 0 ? void 0 : { current: () => knowledgeStore.current() };
 	const runner = new InProcessRunner(options.onEscalation === void 0 ? void 0 : { onEscalation: options.onEscalation });
@@ -16136,6 +16726,7 @@ function createEngine(options) {
 			admission,
 			semaphore: new Semaphore(options.concurrency?.perRun ?? 12),
 			providerLimiter,
+			...quotaRuntime === void 0 ? {} : { quota: quotaRuntime },
 			...options.pricing === void 0 ? {} : { pricingVersion: options.pricing.pricingVersion },
 			...options.budgetDefaults?.flatReserveUsd === void 0 ? {} : { flatReserveUsd: options.budgetDefaults.flatReserveUsd },
 			...defaults.roleFloors === void 0 ? {} : { floors: defaults.roleFloors },
@@ -16810,4 +17401,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };